# Is it WordPress? Five signs a website runs WordPress, and how to confirm it

> Is it WordPress? Look for /wp-content/ and /wp-includes/ in the page source, a generator tag naming WordPress, and a link to the /wp-json/ API. Five signs, how to confirm them without probing the site, and why some WordPress sites hide them.

Updated 2026-09-26 · WordPress & WooCommerce · HTML version: https://getreport.app/guides/how-to-tell-if-a-website-is-wordpress

Is it WordPress? Open the page source (Ctrl+U) and search for `wp-content`: if file paths such as `/wp-content/themes/…` or `/wp-content/plugins/…` appear, the site almost certainly runs WordPress. A `generator` meta tag naming WordPress, `/wp-includes/` paths and a link to the `/wp-json/` API confirm it. Two or three of these signs together are proof; a site that shows none may still be WordPress with its traces removed, or served headless.

This guide is for anyone checking a competitor, vetting a site before taking it on as a client or buying it, or simply curious. You will know the five signs, how to read them in a minute from any desktop browser, and what to make of a site that hides them. WordPress is one of many platforms; the [guide to CMSs and how to tell which one a site uses](https://getreport.app/guides/what-is-a-cms-and-how-to-tell-which-one-a-site-uses) covers the others.

## Quick answer

- **Sign 1:** `/wp-content/` in the page source (themes, plugins, uploads).
- **Sign 2:** `/wp-includes/` paths, WordPress's own core scripts and styles.
- **Sign 3:** `<meta name="generator" content="WordPress 6.x">` in the page head.
- **Sign 4:** a link to the REST API: `rel="https://api.w.org/"` pointing to `/wp-json/`, in the HTML or a `Link` header.
- **Sign 5:** WordPress markup such as `wp-block-` classes or the `wp-emoji` script.
- **Or let a tool read them:** the free [CMS detector](https://getreport.app/tools/tech-stack) names WordPress and shows which sign it matched.

## Sign 1: /wp-content/ in the page source

WordPress keeps everything a site adds on top of the core in one folder: themes in `/wp-content/themes/`, plugins in `/wp-content/plugins/` and uploaded media in `/wp-content/uploads/`. Almost every page loads a stylesheet or script from there, so the path appears in the HTML.

To check, open the page in a desktop browser, press Ctrl+U (Cmd+Option+U on a Mac) to view the source, press Ctrl+F and search for `wp-content`. Typical hits:

```html
<link rel="stylesheet" href="https://example.com/wp-content/themes/astra/style.min.css?ver=4.8.1">
<script src="https://example.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.0"></script>
```

This is the strongest single sign, and it also tells you the theme and plugins, which the guide to [finding the WordPress theme a site uses](https://getreport.app/guides/what-wordpress-theme-is-that) explains.

One caution: check that the paths are on the site's own domain or its CDN. An image embedded from another WordPress site brings that site's `/wp-content/uploads/` path with it.

## Sign 2: /wp-includes/ paths

`/wp-includes/` holds WordPress's own code, and many pages load core scripts from it, such as `/wp-includes/js/jquery/jquery.min.js` or the block library styles at `/wp-includes/css/dist/block-library/style.min.css`. Search the source for `wp-includes`. Together with sign 1, it rules out a lone hotlinked image.

## Sign 3: the generator meta tag

By default WordPress prints its name and version in the page head:

```html
<meta name="generator" content="WordPress 6.8.2">
```

Search the source for `generator`. Many sites remove the tag, often through a security or SEO plugin, so its absence proves nothing. Where it is present, it also gives the version, which is the subject of the guide to [reading the generator tag and updating WordPress safely](https://getreport.app/guides/outdated-cms-versions-reading-the-generator-tag).

WordPress also puts a generator line in its RSS feed, `<generator>https://wordpress.org/?v=6.8.2</generator>`, which some sites forget to remove. If the page links to a feed in its head, that feed is a public page like any other.

## Sign 4: a link to the WordPress REST API

Every WordPress site since version 4.7 has a REST API at `/wp-json/`, and advertises it by default with a link in the page head:

```html
<link rel="https://api.w.org/" href="https://example.com/wp-json/">
```

The same link is often sent as a `Link` response header, which you can see in the developer tools (F12 → **Network**, click the page, **Response Headers**). The `api.w.org` relation is specific to WordPress, which makes it a clean sign.

## Sign 5: WordPress markup

Smaller traces add up when the paths are hidden:

- **`wp-block-` classes**, such as `wp-block-group` or `wp-block-image`, come from the block editor.
- **The `wp-emoji` script**, `wp-emoji-release.min.js`, loaded unless a plugin or theme removes it.
- **Plugin fingerprints**, such as an HTML comment from Yoast SEO or a caching plugin.
- **`wp-json` or `admin-ajax.php` URLs** inside inline scripts.

## Check it with a tool

> **Free tool:** [CMS detector and website technology checker](https://getreport.app/tools/tech-stack): Free CMS detector: see what any website is built with, from CMS and framework to JavaScript libraries, CDN and server, plus known vulnerabilities per version.

The CMS detector loads the page in a real browser and checks all of the signs above, then names WordPress with the evidence it matched, such as the generator tag or the `/wp-content/` path, so you can confirm it yourself. It also names page builders such as Elementor and Divi, common plugins, JavaScript libraries, the CDN and the server.

> **Check: Technology stack.** Knowing the CMS, framework, CDN and analytics behind a page helps you and your developer find the right settings for the fixes in this report.
>
> 1. Nothing to fix; use this list to find the right settings panel for the other findings.

For a WordPress site, two tools go further:

- The [WordPress security scan and health check](https://getreport.app/tools/wordpress-checker) recognises WordPress from the same signs, then looks for classic launch mistakes, an outdated core and closed plugins.
- The [WordPress theme and plugin detector](https://getreport.app/tools/wordpress-plugin-checker) lists the theme, the page builder and every plugin the page loads, with what each costs in kilobytes.

> **Check: CMS version.** Old CMS versions have published security holes that bots scan for automatically, and the generator tag advertises the exact version to them.
>
> 1. Back up the site, then update the CMS from its admin dashboard; update plugins and themes at the same time.
> 2. Remove the generator tag (WordPress: remove_action('wp_head', 'wp_generator') in functions.php).

## Confirm without probing

Everything above reads what the site sends to every visitor. You do not need to go further to answer the question, and on a site you do not own you should not. Visiting `/wp-admin/` or `/wp-login.php`, guessing plugin folders or requesting files such as `readme.html` all show up in the owner's security logs as the kind of requests attack tools make, and some security plugins block your address for it.

getReport follows the same rule: detection is passive, from the page itself, and the WordPress health check requests at most a short fixed list of well-known public addresses.

## Why a WordPress site can look like it is not

- **Traces removed.** Security and "hide WordPress" plugins strip the generator tag, remove the API link and emoji script, and some rewrite `/wp-content/` to another name. A thorough job hides it from quick checks.
- **Headless WordPress.** WordPress stores the content, and a separate front end built with a framework such as Next.js or Astro renders the pages. The visible site shows the framework; WordPress may only surface in image URLs pointing to `/wp-content/uploads/` on another domain.
- **A static export.** Some sites are built in WordPress and exported to plain HTML files. The paths may remain, but there is no WordPress running any more.
- **A page from another system.** A shop on Shopify can have a blog on WordPress, or the reverse. Check the page you care about, not only the home page.

## WordPress.com or self-hosted?

The same software runs on two kinds of service. **WordPress.org** software is installed on hosting you choose; **WordPress.com** is a hosted service by Automattic. Hints for WordPress.com: an address ending in `.wordpress.com`, and files loaded from `s0.wp.com` or `s1.wp.com`. These hints are not proof, because self-hosted sites running Automattic's Jetpack plugin load some files from `wp.com` too. Where a site is hosted is a separate question, answered in the guide to [finding who hosts a website](https://getreport.app/guides/who-is-hosting-this-website).

## What to do with the answer

Knowing a site runs WordPress tells you where to look next:

- its **theme** and **plugins**, from the `/wp-content/` paths;
- its **version**, from the generator tag, and whether it is out of date;
- its **host**, from the IP address and headers.

For your own site, the [WordPress security basics guide](https://getreport.app/guides/wordpress-security-basics-without-a-plugin) covers what visitors and scanners can see and how to reduce it.

## Common mistakes

- **Relying on one sign.** A single `/wp-content/` image can be hotlinked from elsewhere. Look for two or three that agree.
- **Reading a missing generator tag as "not WordPress".** Many WordPress sites remove it.
- **Probing admin paths on someone else's site.** It is not needed and it looks like an attack.
- **Checking only the home page.** A landing page builder or a separate shop can sit on a different system.

## Questions people ask

### Can a WordPress site hide that it runs WordPress?

Mostly, yes. Plugins can remove the generator tag, the REST API link and the emoji script, and some rename the `/wp-content/` folder in URLs. Hiding it this thoroughly is rare, and it does not make a site safer on its own: attack tools try WordPress exploits whether or not the site admits to running it. Keeping WordPress updated matters far more.

### How can I tell WordPress.com from self-hosted WordPress?

Look for an address ending in `.wordpress.com` and files loaded from `s0.wp.com` or `s1.wp.com`, which suggest WordPress.com. Self-hosted sites load everything from their own domain or CDN, although the Jetpack plugin also loads some files from `wp.com`. For a custom domain, the IP address and headers show whether Automattic or another host serves the site.

### Does a /wp-admin/ page prove a site is WordPress?

On your own site, yes, but it is not a good test for someone else's. Requesting admin paths on a site you do not own looks like an attack in the owner's logs and may get your address blocked. The page source already answers the question: `/wp-content/` paths and the `api.w.org` link are clear signs, and they are what every visitor receives anyway.

### Why does a detector say a WordPress site is not WordPress?

Because the page it checked revealed no sign of it. The site may remove the generator tag and rewrite `/wp-content/` paths, render its pages with a headless front end, or serve a page built with another system. Some detectors also read only the raw HTML and miss what scripts add. Check another page and look at the evidence the detector shows.